Secure Boot certificates expired in 2026: check and update your Windows PCs

The Microsoft certificates that Secure Boot has trusted since 2011 expired in 2026; the last one, the Windows Production PCA 2011, on 19 October. PCs keep starting, but a PC that still trusts only the old certificates no longer receives new boot-level security fixes. This guide shows how to check a Windows PC in two minutes, how to move it to the 2023 certificates, and how to do it across a fleet with Intune without triggering BitLocker recovery.

In short

Three 2011 certificates expired: the KEK CA 2011 and the UEFI CA 2011 in June 2026, and the Windows Production PCA 2011, which signs the Windows boot manager, on 19 October 2026.
Your PC will not stop booting, and it keeps getting normal Windows updates. What it loses are future fixes for the boot chain, such as new boot managers and revocations.
One PowerShell line tells you whether the PC already trusts the new Windows UEFI CA 2023.
The update needs current Windows updates, often a firmware (BIOS/UEFI) update from the PC maker, and one or two restarts.
Make sure the BitLocker recovery key is escrowed before you touch the boot chain, and never switch Secure Boot off as a workaround.

Which certificates expired, and what replaces them

Secure Boot decides what may run before Windows starts by checking signatures against certificates stored in the PC's firmware. Microsoft's certificate expiration article lists the 2011 certificates and their 2023 successors:

The 2011 Secure Boot certificates and their replacements
Expired certificate	Expired	What it signs	Replacement
Microsoft Corporation KEK CA 2011	June 2026	Updates to the allowed and blocked lists (DB and DBX)	`Microsoft Corporation KEK 2K CA 2023`
Microsoft UEFI CA 2011	June 2026	Third-party boot loaders, such as Linux shim, and option ROMs	`Microsoft UEFI CA 2023` and `Microsoft Option ROM UEFI CA 2023`
Windows Production PCA 2011	19 October 2026	The Windows boot manager	`Windows UEFI CA 2023`

What happens to a PC that was not updated

According to Microsoft's article When Secure Boot certificates expire on Windows devices, such a PC still starts and still receives regular Windows updates. It can no longer receive new early-boot protections: updated boot managers, new entries in the blocked list (DBX), and fixes for boot-chain vulnerabilities such as the BlackLotus bootkit (CVE-2023-24932). BitLocker protections that rely on an up-to-date Secure Boot chain are weakened too.

The failure is silent: nothing pops up, and the PC simply freezes at its current boot security. That is why it is worth checking now rather than waiting for a problem.

Check a PC in two minutes

Open Windows PowerShell as administrator and run these three checks.

1. Is Secure Boot on?

Confirm-SecureBootUEFI

True means Secure Boot is on. False means it is off, and the certificates do not matter until it is switched on in the firmware settings. An error usually means the PC boots in legacy BIOS mode.

2. Does the firmware already trust the 2023 certificate?

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

True means the allowed list (DB) already contains the new Windows certificate. False means the PC still has to be updated.

3. What does Windows report?

Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing' -Name UEFICA2023Status -ErrorAction SilentlyContinue

Microsoft's Secure Boot playbook uses this value to track progress: it should end at Updated. If the value is missing, Windows has not started the update yet.

The System event log records the result as well: Microsoft's list of Secure Boot DB and DBX update events describes event 1808 as the sign that the firmware holds the new certificates and the 2023-signed boot manager is in use, while events 1797 and 1798 report a failed DBX update.

Update a single PC

Install all Windows updates. The certificate payload only ships with the cumulative updates of 13 May 2025 or later.
Back up the BitLocker recovery key. Changing the boot chain can make BitLocker ask for the 48-digit key on some devices. On a work PC, confirm the key is escrowed to Entra ID: our BitLocker startup PIN guide shows how to check for event 845. On a home PC, find it at account.microsoft.com/devices/recoverykey.
Install the PC maker's latest firmware. Dell, HP, Lenovo and others ship firmware that accepts the new certificates; some older firmware rejects the update. Suspend BitLocker for one restart before a firmware update: Suspend-BitLocker -MountPoint C: -RebootCount 1.
Ask Windows to apply the certificates. Following Microsoft's playbook, set the trigger value and restart:
```
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot' -Name AvailableUpdates -Value 0x5944 -Type DWord
```
Windows applies the update in the background and may need two restarts to finish.
Check again with the three commands above until UEFICA2023Status reads Updated.

Roll it out with Intune

For a fleet, an Intune Remediations pair reports which devices are behind and starts the update on them. Pilot it on a handful of devices from each hardware model first, because firmware behaviour differs between vendors and models.

Detection script: exits 1 (needs remediation) until Windows reports the update as done.

$path = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing'
$status = (Get-ItemProperty -Path $path -Name UEFICA2023Status -ErrorAction SilentlyContinue).UEFICA2023Status
if ($status -eq 'Updated') { Write-Output 'Secure Boot 2023 certificates: Updated'; exit 0 }
Write-Output "Secure Boot 2023 certificates: $(if ($status) { $status } else { 'not started' })"
exit 1

Remediation script: sets the trigger only when Secure Boot is on, so it never touches legacy-BIOS machines.

try { $secureBoot = Confirm-SecureBootUEFI } catch { $secureBoot = $false }   # legacy BIOS throws
if (-not $secureBoot) { Write-Output 'Secure Boot is off or unsupported: skipped'; exit 0 }
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot' -Name AvailableUpdates -Value 0x5944 -Type DWord
Write-Output 'Update requested: completes after the next restarts'
exit 0

Run both as SYSTEM in 64-bit PowerShell. The pre-remediation output column in the Remediations report then becomes your progress list: devices move from not started to Updated as they restart. Devices that stay stuck usually need a firmware update first.

What not to do

Do not switch Secure Boot off to "fix" a warning. Microsoft explicitly advises against it, and it removes the protection entirely.
Do not reset the firmware keys to factory defaults on an updated PC unless the maker's firmware already includes the 2023 certificates; you could roll the PC back to the expired set.
Do not push the change to every device at once. Pilot per hardware model, with recovery keys at hand.

Questions people ask

Will my PC stop booting now that the certificates have expired?

No. Already-installed, signed boot components keep working. The PC only stops receiving new boot-level security updates until it trusts the 2023 certificates.

Does Windows Update fix this on its own?

On many PCs Microsoft is rolling the certificates out through Windows Update, as long as the firmware accepts them. Use the checks above to confirm instead of assuming.

Can the update trigger BitLocker recovery?

It can on some devices, because the boot components BitLocker measures change. Keep the recovery key available and suspend BitLocker for one restart during firmware updates.

I dual-boot Linux. Does this affect me?

Possibly. Linux shim loaders signed with the old Microsoft UEFI CA 2011 keep working on PCs that still trust it, but new shims are signed with the 2023 certificate. Check your distribution's Secure Boot notes before and after the update.

Does this apply to Windows 10 too?

Yes, if the PC is fully updated. Windows 10 PCs enrolled in Extended Security Updates receive the same payload; see our Windows 10 ESU guide for who is still covered.